3

Installed Fail2ban on my Mail Server.

As instructed, I copied the jail.conf into jail.local

Here's what I have in my jail.local. I also copied logs from the log file of fail2ban.

To me, it seems like the other jails that I have enabled in the jail.local are not starting, because the log file only says SSHD jail started, I don't see other jails starting.

EDIT** When I try to start it manually, it says jail does not exist. If I try to start SSHD, it works just fine and says jail started. 

/home/USER/Maildir# fail2ban-client start postfix
 NOK: ('postfix',)
Sorry but the jail 'postfix' does not exist
/home/USER/Maildir# fail2ban-client start postfix-rbl
 NOK: ('postfix-rbl',)
Sorry but the jail 'postfix-rbl' does not exist

Here is what I have in jail.local

[sshd]
  enable = true
  port    = ssh
  logpath = %(sshd_log)s
  backend = %(sshd_backend)s

I also have other services enabled

[postfix]
  enable = true
  mode    = more
  port    = smtp,465,submission
  logpath = %(postfix_log)s
  backend = %(postfix_backend)s
  maxretry = 1
  bantime = 48h

[postfix-rbl]
  enable = true
  filter   = postfix[mode=rbl]
  port     = smtp,465,submission
  logpath  = %(postfix_log)s
  backend  = %(postfix_backend)s
  maxretry = 1


[sendmail-auth]
  enable = true
  port    = submission,465,smtp
  logpath = %(syslog_mail)s
  backend = %(syslog_backend)s
  maxretry = 1

/var/log/fail2ban.log Says:

2020-05-11 23:26:50,209 fail2ban.server         [10790]: INFO    Starting Fail2ban v0.10.2
2020-05-11 23:26:50,212 fail2ban.database       [10790]: INFO    Connected to fail2ban persistent database '/var/lib/fail2ban/fail2ban.sqlite3'
2020-05-11 23:26:50,213 fail2ban.jail           [10790]: INFO    Creating new jail 'sshd'
2020-05-11 23:26:50,226 fail2ban.jail           [10790]: INFO    Jail 'sshd' uses pyinotify {}
2020-05-11 23:26:50,229 fail2ban.jail           [10790]: INFO    Initiated 'pyinotify' backend
2020-05-11 23:26:50,230 fail2ban.filter         [10790]: INFO      maxLines: 1
2020-05-11 23:26:50,255 fail2ban.server         [10790]: INFO    Jail sshd is not a JournalFilter instance
2020-05-11 23:26:50,256 fail2ban.filter         [10790]: INFO    Added logfile: '/var/log/auth.log' (pos = 635398, hash = f27994565e613699182c4d7ceadd7904b0e587e4)
2020-05-11 23:26:50,259 fail2ban.filter         [10790]: INFO      encoding: UTF-8
2020-05-11 23:26:50,260 fail2ban.filter         [10790]: INFO      maxRetry: 2
2020-05-11 23:26:50,260 fail2ban.filter         [10790]: INFO      findtime: 600
2020-05-11 23:26:50,260 fail2ban.actions        [10790]: INFO      banTime: 600000
2020-05-11 23:26:50,415 fail2ban.jail           [10790]: INFO    Jail 'sshd' started
2020-05-11 23:26:50,466 fail2ban.actions        [10790]: NOTICE  [sshd] Restore Ban X.X.X.X
.......

More from fail2ban after EDIT from above. I tried start, and reload jail still doesn't work

2020-05-12 03:10:25,816 fail2ban.transmitter    [10790]: WARNING Command ['postfix'] has failed. Received Exception('Invalid command')
2020-05-12 08:37:41,716 fail2ban.transmitter    [10790]: WARNING Command ['[postfiadsx]'] has failed. Received Exception('Invalid command')
2020-05-12 08:37:48,752 fail2ban.transmitter    [10790]: WARNING Command ['[postfix]'] has failed. Received Exception('Invalid command')
2020-05-12 20:10:09,314 fail2ban.transmitter    [10790]: WARNING Command ['sshd'] has failed. Received Exception('Invalid command')
2020-05-12 20:10:15,211 fail2ban.transmitter    [10790]: WARNING Command ['[sshd]'] has failed. Received Exception('Invalid command')
2020-05-12 20:16:36,680 fail2ban.transmitter    [10790]: WARNING Command ['[start,', 'sshd]'] has failed. Received Exception('Invalid command')
2020-05-12 20:34:24,968 fail2ban.transmitter    [10790]: WARNING Command ['start', 'postfix'] has failed. Received UnknownJailException('postfix')
2020-05-12 20:34:42,339 fail2ban.transmitter    [10790]: WARNING Command ['start', 'postfix-rbl'] has failed. Received UnknownJailException('postfix-rbl')
2020-05-12 20:47:09,239 fail2ban.server         [10790]: INFO    Reload jail postfix-rbl
2020-05-12 20:47:09,240 fail2ban.server         [10790]: INFO    Reload finished.
2020-05-12 20:47:09,240 fail2ban.transmitter    [10790]: WARNING Command ['reload', 'postfix-rbl', [], [['set', 'syslogsocket', 'auto'], ['set', 'loglevel', 'INFO'], ['set', 'logtarget', '/var/log/fail2ban.log'], ['set', 'dbfile', '/var/lib/fail2ban/fail2ban.sqlite3'], ['set', 'dbpurgeage', '1d']]] has failed. Received UnknownJailEx
Improve this question
3
  • If you run "sudo fail2ban-client -d" what output do you get? Likewise you can call fail2ban-client and pass the jail name for testing.
    – Admiral Noisy Bottom
    May 12, 2020 at 5:26
  • Lines similar to this followed by a Regex followed by more lines. The last tine caught my attention ['start', 'sshd'] ['set', 'syslogsocket', 'auto'] l2ban.log'] ......... Regex More Lines
    – Maan
    May 12, 2020 at 12:32
  • Anyone? Please take a look at the edits I just made. Thanks.
    – Maan
    May 13, 2020 at 0:57

2 Answers 2

Reset to default
4

I remember it should be this syntax:

enabled = true

"enabled" not "enable"

Improve this answer
4
  • This did the trick, omg I feel like an idiot now lol. Really sorry I cannot upvote, still a new user but hopefully I keep learning and I'll get more points. Thanks You. Status |- Number of jail: 3 `- Jail list: postfix, postfix-rbl, sshd.
    – Maan
    May 13, 2020 at 3:24
  • No problem. Cuz I made this mistake too. You can just accept this answer instead of upvote.
    – George Y
    May 13, 2020 at 3:43
  • I feel like a mistake like this should have been thrown in the log. It just ignored it and moved on.
    – Maan
    May 13, 2020 at 4:26
  • LOL, I didn't pick it up either and I read your question carefully - or I thought I did. :)
    – Admiral Noisy Bottom
    May 13, 2020 at 8:31
0

If all the other service was installed by default, it should be working properly. However, fail2ban seems to encounter trouble viewing logs. Make sure you launch fail2ban as root user. Non-root users have no access to /var/log/

Improve this answer
2
  • All were there by default, were copied from jail.conf to jail.local. The only addition I placed next to each service was enable = true. I did run it as sudo /etc/init.d/fail2ban stop sudo /etc/init.d/fail2ban start Still no luck.
    – Maan
    May 13, 2020 at 2:41
  • Try install python-garmin to give jail2ban an alternative to pyinotify
    – George Y
    May 13, 2020 at 2:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.